US11438137B2

Encryption device, decryption device, encryption method, decryption method, and computer readable medium

Summary by NHIP

Block Cipher Encryption Device

The encryption device divides a message into blocks and updates a variable using a block cipher and exclusive OR operations. It generates ciphertext by extracting bits from the updated variable and produces an authenticator from the final variable state.

Claim Score by NHIP

Read claim 8, the broadest

Abstract

An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data S0 of n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.

US11438137B2, drawing sheet 1 — Sheet 1 of 13

Term

11.7 yearsleft in the term

Expires 16 June 2038, including 288 days of term adjustment.

11 claims: 6 independent, 5 dependent

1
An encryption device for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption device comprising:processing circuitry to: receive a message M;divide the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m], set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c, update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order, generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m, generate an authenticator T of t bits from the variable S that has been updated most recently, where t is an integer of 1 or greater, the processing circuitry updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T by extracting t bits from the variable S that has been updated, transmit the generated authenticator T and ciphertext C to a decryption device.
4
A decryption device for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption device comprising:processing circuitry to: receive an authenticator T and a ciphertext C, divide the ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C [m], set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c, update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculate data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order, generate a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m, generate an authenticator T′ of t bits from the variable S that has been updated most recently, where t is an integer of 1 or greater, the processing circuitry updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T′ by extracting t bits from the variable S that has been updated, and outputting, when the received authenticator T is equal to the generated authenticator T′ the generated message M.
8
Broadest claimClaim Score 16, narrow(NHIP)An encryption method for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption method comprising:receiving a message M, dividing the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m];setting a variable to set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c;updating the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generating data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order;generating a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m;and updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating an authenticator T oft bits from the variable S that has been updated, where t is an integer of 1 or greater;and transmitting the generated authenticator T and ciphertext C to a decryption device.
9
A decryption method for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption method comprising:receiving an authenticator T and a ciphertext C;dividing the ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C[m];setting a variable to set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c;updating the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculating data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], and updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order;generating a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m;updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating an authenticator T′ oft bits from the variable S that has been updated, where t is an integer of 1 or greater;and outputting, when the received authenticator T is equal to the generated authenticator T′ the generated message M.
10
A non-transitory computer readable medium storing an encryption program for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption program causing a computer to execute:a reception process to receive a message M;a division process to divide the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m];a variable setting process to set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant cons-[1], where n, b, and c are integers and n=b+c;a function calculation process to update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order;a ciphertext generation process to generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m;an authenticator generation process to generate an authenticator T of t bits from the variable S that has been updated most recently by the function calculation process, where t is an integer of 1 or greater, the authenticator generation process updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T by extracting t bits from the variable S that has been updated;and a transmission process to transmit the generated authenticator T and ciphertext C to a decryption device.
11
A non-transitory computer readable medium storing a decryption program for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption program causing a computer to execute:a reception process to receive an authenticator T and ciphertext C;a division process to divide a ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C[m];a variable setting process to set to a variable S data of obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant cons-[1], where n, b, and c are integers and n=b+c;a function calculation process to update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculate data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], and update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order;a message generation process to generate a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m;and an authenticator generation process to generate an authenticator T′ of t bits from the variable S that has been updated most recently by the function calculation process, where t is an integer of 1 or greater, the authenticator generation process updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T′ by extracting t bits from the variable S that has been updated;an output process to output, when the received authenticator T is equal to the generated authenticator T′, the generated message M.

Independent claims6

197 paragraphs in 7 sections, as filed

TECHNICAL FIELD

0001The present invention relates to an authenticated encryption algorithm using a block cipher.

BACKGROUND ART

0002An authenticated encryption algorithm is an encryption algorithm that realizes a confidentiality function and a tampering detection function. The use of the authenticated encryption algorithm allows communication of a message between two parties while maintaining confidentiality, and also allows a receiver to check whether or not the transmitted message has been tampered with.

0003The authenticated encryption algorithm includes two algorithms: an encryption function Enc and a decryption function Dec.

0004The encryption function Enc is a function that takes as input a secret key K, an initial parameter N, public data A, and a message m, and outputs a ciphertext C and an authenticator T for tampering detection. Note that a different value is used as the initial parameter N each time encryption is performed.

0005The decryption function Dec is a function that takes as input the secret key K, the initial parameter N, the public data A, the ciphertext C, and the authenticator T for tampering detection, and outputs the message m if the ciphertext C or the like has not been tampered with, and does not output the message m if the ciphertext C or the like has been tampered with.

0006It is assumed that a sender Alice and a receiver Bob communicate using the authenticated encryption algorithm. In this case, the sender Alice calculates a ciphertext C and an authenticator T for tampering detection from a secret key K, an initial parameter N, public data A, and a message m, using the encryption function Enc. Then, the sender Alice sends the initial parameter N, the public data A, the ciphertext C, and the authenticator T for tampering detection to the receiver Bob. The receiver Bob uses, as input to the decryption function Dec, the secret key K, the initial parameter N, the public data A, the ciphertext C, and the authenticator T for tampering detection. If none of the initial parameter N, the public data A, the ciphertext C, and the authenticator T for tampering detection has been tampered with, the decryption function Dec outputs the message m.

0007Note that the secret key K is shared between Alice and Bob in advance. The public data A is a value that may be made public. The public data A may be omitted.

0008As a method for constructing an authenticated encryption algorithm, there is a method using a block cipher such as the Advanced Encryption Standard (AES) described in Non-Patent Literature 1.

0009The block cipher is composed of an encryption function E and a decryption function D. The encryption function E is a function that takes as input a key K and a message m of n bits, and outputs a ciphertext c of n bits. This will be denoted as c=EK(m). The decryption function D is a function that takes as input the key K and the ciphertext c of n bits, and outputs the message m of n bits. This will be denoted as m=DK(c).

0010A size n of the message m and the ciphertext c of the block cipher is called a block size. When the key K is fixed, the encryption function E and the decryption function D of the block cipher are permutation functions of n bits. The block size n is a parameter defined by the block cipher. In the AES, n is 128.

0011The encryption function Enc of authenticated encryption is constructed using the encryption function E of the block cipher. The decryption function Dec of authenticated encryption is constructed using the encryption function E or the decryption function D of the block cipher.

0012When the decryption function Dec of authenticated encryption is constructed using the decryption function D of the block cipher, both the encryption function E and the decryption function D of the block cipher are used in authenticated encryption. When both the encryption function E and the decryption function D of the block cipher are used in authenticated encryption, both the encryption function E and the decryption function D need to be implemented. For example, for implementation in software, programs of both the encryption function E and the decryption function D are needed. For implementation in hardware, circuits or the like of both the encryption function E and the decryption function D are needed.

0013On the other hand, when the decryption function Dec of authenticated encryption uses the encryption function E of the block cipher, only the encryption function E of the block cipher is used in authenticated encryption. When only the encryption function E of the block cipher is used in authenticated encryption, there is no need to implement the decryption function D. Therefore, the size of software or hardware is small. The size of software and the size of hardware are called implementation sizes.

0014As an authenticated encryption algorithm that can be implemented with only the encryption function E of the block cipher, there is AES-GCM described in Non-Patent Literature 2. AES-GCM realizes the encryption function Enc and the decryption function Dec of authenticated encryption by using a counter mode in order to realize the confidentiality function. AES-GCM also uses multiplication over a Galois field GF(2n) in order to realize the tampering detection function. In the counter mode, which is an algorithm of the confidentiality function, an exclusive OR (XOR) operation is used in addition to the encryption function E of the block cipher.

0015Therefore, AES-GCM requires the implementation of the multiplication over the Galois field GF(2n) and the exclusive OR, in addition to the encryption function E.

0016Non-Patent Literature 3 describes an authenticated encryption algorithm JAMBU constructed with only the encryption function E and the exclusive OR (XOR). JAMBU does not require the multiplication over the Galois field GF(2n), so that the implementation size is smaller than that of AES-GCM.

0017The encryption function Enc or the decryption function Dec of the authenticated encryption algorithm JAMBU performs encryption while updating an internal variable of 3n/2 bits using the encryption function E of the block cipher.

CITATION LIST

Non-Patent Literature

0018Non-Patent Literature 1: FIPS 197, Advanced Encryption Standard (AES).

0019Non-Patent Literature 2: NIST Special Publication 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC.

0020Non-Patent Literature 3: Submitted to the CAESAR competition, The JAMBU Lightweight Authentication Encryption Mode (v2.1).

SUMMARY OF INVENTION

Technical Problem

0021In addition to the implementation size, the size of the internal variable used during execution of the authenticated encryption algorithm is also important. In an inexpensive device such as an embedded device, the size of RAM and the size of ROM are small. In a case like this where the implementation environment is limited, it is desirable that the implementation size and the size of the internal variable be as small as possible. The internal variable is a value to be updated by the block cipher E. For example, the size of the internal variable is 3n/2 bits in JAMBU. In AES-GCM, the size of the internal variable is required to be 2n bits or greater.

0022It is an object of the present invention to realize an authenticated encryption algorithm with which the implementation size and the size of an internal variable can be made small.

Solution to Problem

0023An encryption device according to the present invention includes: <ul id="ul0001" list-style="none"><li id="ul0001-0001" num="0000"><ul id="ul0002" list-style="none"><li id="ul0002-0001" num="0024">a division unit to divide a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m] each having b bits;</li><li id="ul0002-0002" num="0025">a function calculation unit to set data S0 of n=b+c bits to a variable S, update the variable S with data obtained by calculating a block cipher E using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order;</li><li id="ul0002-0003" num="0026">a ciphertext generation unit to generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, . . . , m; and</li><li id="ul0002-0004" num="0027">an authenticator generation unit to extract, as an authenticator T, t bits from the variable S that has been updated most recently by the function calculation unit, where t is an integer of 1 or greater.</li></ul></li></ul>

Advantageous Effects of Invention

0028In the present invention, an authenticated encryption algorithm can be constructed from an encryption function E of a block cipher and an exclusive OR (XOR). The size of a variable S, which is an internal variable, is n bits. Therefore, the size of the internal variable can be made smaller than that of the authenticated encryption algorithm JAMBU while the implementation size is equivalent to that of the authenticated encryption algorithm JAMBU.

BRIEF DESCRIPTION OF DRAWINGS

0029<figref idref="DRAWINGS">FIG. 1</figref> is a configuration diagram of an encryption device 10 according to a first embodiment;

0030<figref idref="DRAWINGS">FIG. 2</figref> is a configuration diagram of a decryption device 20 according to the first embodiment;

0031<figref idref="DRAWINGS">FIG. 3</figref> is a flowchart illustrating operation of the encryption device 10 according to the first embodiment;

0032<figref idref="DRAWINGS">FIG. 4</figref> is a diagram describing operation of the encryption device 10 according to the first embodiment;

0033<figref idref="DRAWINGS">FIG. 5</figref> is a flowchart illustrating operation of the decryption device 20 according to the first embodiment;

0034<figref idref="DRAWINGS">FIG. 6</figref> is a diagram describing operation of the decryption device 20 according to the first embodiment;

0035<figref idref="DRAWINGS">FIG. 7</figref> is a configuration diagram of an encryption device 10 according to a first variation;

0036<figref idref="DRAWINGS">FIG. 8</figref> is a configuration diagram of a decryption device 20 according to the first variation;

0037<figref idref="DRAWINGS">FIG. 9</figref> is a configuration diagram of an encryption device 10 according to a second embodiment;

0038<figref idref="DRAWINGS">FIG. 10</figref> is a configuration diagram of a decryption device 20 according to the second embodiment;

0039<figref idref="DRAWINGS">FIG. 11</figref> is a flowchart illustrating operation of the encryption device 10 and the decryption device 20 according to the second embodiment; and

0040<figref idref="DRAWINGS">FIG. 12</figref> is a diagram describing operation of the encryption device 10 and the decryption device 20 according to the second embodiment.

DESCRIPTION OF EMBODIMENTS

First Embodiment

0041In a first embodiment, an authenticated encryption algorithm constructed using an encryption function E of a block cipher with a block size n will be described.

0042*** Description of Variables and Notation ***

0043Variables and notation in the following description will be described.

0044An integer b, an integer c, an integer b″, and an integer c″ satisfy the relationships c=n−b and c″=n−b″. An integer t satisfies the relationship t≤n.

0045A y-bit representation of an integer x will be denoted as str[y](x). For example, str[4](2) denotes 0010. The most significant w bits of a bit string z of n bits will be denoted as msb[w](z), and the least significant w bits will be denoted as Lsb[w](z). The bit length of a bit string w will be denoted as Len(w).

0046Each of const[1], const[2], and const[3] is an integer that is not 0 and is a value different from one another.

0047*** Description of Configuration ***

0048A configuration of an encryption device 10 according to the first embodiment will be described with reference to <figref idref="DRAWINGS">FIG. 1</figref>.

0049The encryption device 10 includes hardware of a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected with other hardware components via signal lines and controls these other hardware components.

0050The encryption device 10 includes, as functional components, an acceptance unit 111, a division unit 112, a variable setting unit 113, a function calculation unit 114, an authenticator generation unit 115, a ciphertext generation unit 116, and an output unit 117. The functions of the functional components of the encryption device 10 are realized by software.

0051The storage 13 stores programs for realizing the functions of the functional components of the encryption device 10. These programs are read into the memory 12 by the processor 11 and executed by the processor 11. This realizes the functions of the functional components of the encryption device 10.

0052A configuration of a decryption device 20 according to the first embodiment will be described with reference to <figref idref="DRAWINGS">FIG. 2</figref>.

0053The decryption device 20 includes hardware of a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected with other hardware components via signal lines and controls these other hardware components.

0054The decryption device 20 includes, as functional components, an acceptance unit 211, a division unit 212, a variable setting unit 213, a function calculation unit 214, an authenticator generation unit 215, a message generation unit 216, and an output unit 217. The functions of the functional components of the decryption device 20 are realized by software.

0055The storage 23 stores programs for realizing the functions of the functional components of the decryption device 20. These programs are read into the memory 22 by the processor 21 and executed by the processor 21. This realizes the functions of the functional components of the decryption device 20.

0056Each of the processors 11 and 21 is an integrated circuit (IC) that performs processing. As a specific example, each of the processors 11 and 21 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU).

0057Each of the memories 12 and 22 is a storage device to temporarily store data. As a specific example, each of the memories 12 and 22 is a static random access memory (SRAM) or a dynamic random access memory (DRAM).

0058Each of the storages 13 and 23 is a storage device to store data. As a specific example, each of the storages 13 and 23 is a hard disk drive (HDD). Alternatively, each of the storages 13 and 23 may be a portable storage medium, such as a Secure Digital (SD) memory card, CompactFlash (CF, registered trademark), a NAND flash, a flexible disk, an optical disc, a compact disc, a Blu-ray (registered trademark) disc, or a digital versatile disk (DVD).

0059Each of the communication interfaces 14 and 24 is an interface to communicate with an external device. As a specific example, each of the communication interfaces 14 and 24 is a port of Ethernet (registered trademark), Universal Serial Bus (USB), or High-Definition Multimedia Interface (HDMI, registered trademark).

0060*** Description of Operation ***

0061Operation of the encryption device 10 and the decryption device 20 according to the first embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 3 to 6</figref>.

0062The operation of the encryption device 10 according to the first embodiment corresponds to an encryption method according to the first embodiment. The operation of the encryption device 10 according to the first embodiment also corresponds to processes of an encryption program according to the first embodiment.

0063The operation of the decryption device 20 according to the first embodiment corresponds to a decryption method according to the first embodiment. The operation of the decryption device 20 according to the first embodiment also corresponds to processes of a decryption program according to the first embodiment.

0064The operation of the encryption device 10 according to the first embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 3 and 4</figref>.

0065(Step S11: Acceptance Process)

0066The acceptance unit 111 accepts input of a message M to be encrypted.

0067Specifically, the acceptance unit 111 accepts, via the communication interface 14, the message M that is input by a user through operation of an input device.

0068(Step S12: Division Process)

0069The division unit 112 determines whether or not a length Len(M) of the message M accepted in step S11 is a multiple of b bits. If the length Len(M) is not a multiple of b bits, 1 is added to the end of the message M and a bit string of 0 is further added to the end so that the length Len(M) is a multiple of b bits, so as to generate data M*. On the other hand, if the length Len(M) is a multiple of b bits, the message M is treated as the data M*.

0070The division unit 112 divides the data M* from the beginning into blocks of b bits, so as to generate data M[1], . . . , data M[m], where “m” is an integer of 1 or greater.

0071(Step S13: Variable Setting Process)

0072The variable setting unit 113 sets, to a variable S internal to the encryption device 10, data obtained by calculating an exclusive OR using, as input, data S0 of n bits and data Y that is a concatenation of an initial parameter N of b″ bits and a constant const[1] of c″ bits. That is, the variable setting unit 113 calculates S=S0 XOR (N∥const[1]).

0073In the first embodiment, the data S0 is fixed data IV. The variable S internal to the encryption device 10 is a variable stored in the memory 12 of the encryption device 10.

0074(Step S14: Function Calculation Process)

0075The function calculation unit 114 executes the following processes A to C for each integer i=1, . . . , m in ascending order.

0076(Process A)

0077The function calculation unit 114 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E of the block cipher using as input the variable S and a key K. Note here that the key K is shared between the encryption device 10 and the decryption device 20 in advance.

0078That is, the function calculation unit 114 calculates S=EK(S).

0079(Process B)

0080The function calculation unit 114 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S updated in the process A and data X[i] that is data M[i] to which a bit string of c bits is added. Here, the function calculation unit 114 uses the data X[i] that is the data M[i] to the end of which c bits of 0 are added.

0081That is, the function calculation unit 114 calculates S=S XOR (M[i]∥0c.

0082(Process C)

0083The function calculation unit 114 extracts b bits from the variable S updated in the process B so as to generate data C[i]. Here, the function calculation unit 114 extracts the most significant b bits of the variable S so as to generate the data C[i].

0084That is, the function calculation unit 114 calculates C[i]=msb[b](S).

0085(Step S15: Authenticator Generation Process)

0086If the length of the message M is a multiple of b bits, the authenticator generation unit 115 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S14 and a constant const[2]. Here, the authenticator generation unit 115 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[2] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 115 calculates S=S XOR (0b∥str[c](const[2])).

0087On the other hand, if the length of the message M is not a multiple of b bits, the authenticator generation unit 115 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S14 and a constant const[3]. Here, the authenticator generation unit 115 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[3] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 115 calculates S=S XOR (0b∥str[c](const[3])).

0088The authenticator generation unit 115 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S that has been updated. That is, the authenticator generation unit 115 calculates S=EK(S).

0089Then, the authenticator generation unit 115 extracts, as an authenticator T, t bits from the variable S that has been updated. Here, the authenticator generation unit 115 extracts the most significant t bits from the variable S, so as to generate the authenticator T. That is, the authenticator generation unit 115 calculates T=msb[t](S).

0090(Step S16: Ciphertext Generation Process)

0091The ciphertext generation unit 116 concatenates the respective pieces of the data c[i] for each integer i=1, . . . , m calculated in step S14. The ciphertext generation unit 116 extracts only the most significant bits of the length Len(M) of the message M from the concatenated data, so as to generate a ciphertext C that is the encrypted message M.

0092That is, the ciphertext generation unit 116 calculates C=msb[Len(M)](C[1]∥ . . . ∥C[m−1]∥C[m]).

0093(Step S17: Output Process)

0094The output unit 117 outputs the authenticator T calculated in step S15 and the ciphertext C generated in step S16.

0095Specifically, the output unit 117 transmits the authenticator T and the ciphertext C to the decryption device 20 via the communication interface 14.

0096The operation of the decryption device 20 according to the first embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 5 and 6</figref>.

0097(Step S21: Acceptance Process)

0098The acceptance unit 211 accepts input of the authenticator T and the ciphertext C.

0099Specifically, the acceptance unit 111 receives, via the communication interface 24, the authenticator T and the ciphertext C transmitted by the encryption device 10.

0100(Step S22: Division Process)

0101The division unit 212 divides the ciphertext C accepted in step S21 from the beginning into blocks of b bits, so as to generate data C[1], . . . , data C[m].

0102If a length Len(C) of the ciphertext C is not a multiple of b bits, a length Len(C[m]) of the data C[m] is shorter than b bits. If the length Len(C) is a multiple of b bits, the length Len(C[m]) is b bits.

0103(Step S23: Variable Setting Process)

0104The variable setting unit 213 sets, to a variable S internal to the decryption device 20, data obtained by calculating an exclusive OR using, as input, data S0 of n bits and data Y that is a concatenation of the initial parameter N of b″ bits and the constant const[1] of c″ bits. That is, the variable setting unit 213 calculates S=S0 XOR (N∥const[1]).

0105In the first embodiment, the data S0 is the fixed value IV. The data S0 that is set here is the same data as the data S0 that is set in step S13 of <figref idref="DRAWINGS">FIG. 3</figref>. The variable S internal to the decryption device 20 is a variable stored in the memory 22 of the decryption device 20.

0106(Step S24: Function Calculation Process)

0107The function calculation unit 214 executes the following processes A′ to C′ for each integer i=1, . . . , m−1 in ascending order. Then, the function calculation unit 214 executes processes D′ to E′.

0108(Process A′)

0109The function calculation unit 214 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E of the block cipher using as input the variable S and the key K. Note here that the key K is shared between the encryption device 10 and the decryption device 20 in advance.

0110That is, the function calculation unit 214 calculates S=EK(S).

0111(Process B′)

0112The function calculation unit 214 calculates an exclusive OR using, as input, b bits extracted from the variable S updated in the process A′ and data C[i], so as to calculate data M[i]. Here, the function calculation unit 214 extracts the most significant b bits of the variable S updated in the process A′, and calculates the exclusive OR using as input the extracted data and the data C[i].

0113That is, the function calculation unit 214 calculates M[i]=C[i] XOR msb[b](S).

0114(Process C′)

0115The function calculation unit 214 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S updated in the process A′ and data X[i] that is the data M[i] to which a bit string of c bits is added. Here, the function calculation unit 214 uses the data X[i] that is the data M[i] to the end of which c bits of 0 are added.

0116That is, the function calculation unit 214 calculates S=S XOR (M[i]∥0c.

0117(Process D′)

0118The function calculation unit 214 calculates an exclusive OR using, as input, bits of the length Len(C[m]) extracted from the beginning of the variable S updated in the process C′ and the data C[m], so as to calculate data M[m].

0119That is, the function calculation unit 214 calculates M[m]=C[m] XOR msb[Len(C[m])](S).

0120(Process E′)

0121If a length Len(M[m]) of the data M[m] generated in the process D′ is shorter than b bits, the function calculation unit 214 adds 1 to the end of the data M[m] and further adds a bit string of 0 to the end so that the length Len(M[m]) is b bits, so as to generate data M*[m]. On the other hand, if the length Len(M[m]) is b bits, the data M[m] is treated as the data M*[m].

0122Then, the function calculation unit 214 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S updated in the process C′ and data X[m] that is the data M*[m] to which a bit string of c bits is added. Here, the function calculation unit 214 uses the data X[m] that is the data M*[m] to the end of which c bits of 0 are added.

0123That is, the function calculation unit 214 calculates S=S XOR (M*[m]∥0c).

0124(Step S25: Authenticator Generation Process)

0125If the length of the ciphertext C is a multiple of b bits, the authenticator generation unit 215 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S24 and the constant const[2]. Here, the authenticator generation unit 215 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[2] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 215 calculates S=S XOR (0b∥str[c](const[2])).

0126On the other hand, if the length of the ciphertext C is not a multiple of b bits, the authenticator generation unit 215 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S24 and the constant const[3]. Here, the authenticator generation unit 215 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[3] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 215 calculates S=S XOR (0b∥str[c](const[3])).

0127The authenticator generation unit 215 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S that has been updated. That is, the authenticator generation unit 215 calculates S=EK(S).

0128Then, the authenticator generation unit 215 extracts, as an authenticator T′, t bits from the variable S that has been updated. Here, the authenticator generation unit 215 extracts the most significant t bits from the variable S, so as to generate the authenticator T′. That is, the authenticator generation unit 215 calculates T′=msb[t](S).

0129(Step S26: Message Generation Process)

0130The message generation unit 216 concatenates the respective pieces of the data M[i] for each integer i=1, . . . , m calculated in step S24. The ciphertext generation unit 116 extracts only the most significant bits of the length Len(C) of the ciphertext C from the concatenated data, so as to generate a message M that is the decrypted ciphertext C.

0131That is, the ciphertext generation unit 116 calculates M=msb[Len(C)](M[1]∥ . . . ∥M[m−1]∥M[m]).

0132(Step S27: Output Process)

0133If the authenticator T accepted in step S21 and the authenticator T′ calculated in step S25 coincide with each other, the output unit 217 outputs the message M generated in step S25. Specifically, the output unit 217 transmits the message M to a display device or the like via the communication interface 24.

0134On the other hand, if the authenticator T accepted in step S21 and the authenticator T′ calculated in step S26 do not coincide with each other, the output unit 217 outputs a message indicating that the authenticator T and the authenticator T′ do not coincide with each other.

0135*** Effects of First Embodiment ***

0136As described above, the encryption device 10 and the decryption device 20 according to the first embodiment allow the construction of an authenticated encryption algorithm from the encryption function E of the block cipher and the exclusive OR (XOR) without using a decryption function of the block cipher. The size of the variable S, which is an internal variable, is n bits. Therefore, the size of the internal variable can be made smaller than that of the authenticated encryption algorithm JAMBU while the implementation size is equivalent to that of the authenticated encryption algorithm JAMBU.

0137*** Other Configurations ***

0138<First Variation>

0139In the first embodiment, the functions of the functional components of the encryption device 10 and the decryption device 20 are realized by software. As a first variation, however, the functions of the functional components of the encryption device 10 and the decryption device 20 may be realized by hardware. With respect to this first variation, differences from the first embodiment will be described.

0140A configuration of an encryption device 10 according to the first variation will be described with reference to <figref idref="DRAWINGS">FIG. 7</figref>.

0141When the functions of the functional components are realized by hardware, the encryption device 10 includes an electronic circuit 15, in place of the processor 11, the memory 12, and the storage 13. The electronic circuit 15 is a dedicated electronic circuit that realizes the functions of the units of the encryption device 10 and the functions of the memory 12 and the storage 13.

0142A configuration of a decryption device 20 according to the first variation will be described with reference to <figref idref="DRAWINGS">FIG. 8</figref>.

0143When the functions of the functional components are realized by hardware, the decryption device 20 includes an electronic circuit 25, in place of the processor 21, the memory 22, and the storage 23. The electronic circuit 25 is a dedicated electronic circuit that realizes the functions of the units of the decryption device 20 and the functions of the memory 22 and the storage 23.

0144Each of the electronic circuits 15 and 25 is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

0145The functions of the units of the encryption device 10 may be realized by a single electronic circuit 15. The functions of the units of the encryption device 10 may be distributed among and realized by a plurality of electronic circuits 15. Similarly, the functions of the units of the decryption device 20 may be realized by a single electronic circuit 25. The functions of the units of the decryption device 20 may be distributed among and realized by a plurality of electronic circuits 25.

0146<Second Variation>

0147As a second variation, some of the functions may be realized by hardware, and the rest of the functions may be realized by software. That is, some of the functions of the functional components of the encryption device 10 may be realized by hardware, and the rest of the functions may be realized by software. Similarly, some of the functions of the functional components of the decryption device 20 may be realized by hardware, and the rest of the functions may be realized by software.

0148Each of the processors 11 and 21, the memories 12 and 22, the storages 13 and 23, and the electronic circuits 15 and 25 is referred to as processing circuitry. That is, the functions of the units of the encryption device 10 and the decryption device 20 are realized by the processing circuitry.

Second Embodiment

0149A second embodiment differs from the first embodiment in that public data A is involved. In the second embodiment, this difference will be described and description of the same portions will be omitted.

0150*** Description of Variables and Notation ***

0151An integer b′ and an integer c′ satisfy the relationship c′=n−b′.

0152The value of const[4] and the value of const[5] are different from each other. The value of const[4] and the value of const[5] are different from the value of const[1].

0153*** Description of Configuration ***

0154A configuration of an encryption device 10 according to the second embodiment will be described with reference to <figref idref="DRAWINGS">FIG. 9</figref>.

0155The encryption device 10 differs from the encryption device 10 illustrated in <figref idref="DRAWINGS">FIG. 1</figref> in that an advance calculation unit 118 is included as a functional component. As with the other functional components, the advance calculation unit 118 is realized by software or hardware.

0156A configuration of a decryption device 20 according to the second embodiment will be described with reference to <figref idref="DRAWINGS">FIG. 10</figref>.

0157The decryption device 20 differs from the decryption device 20 illustrated in <figref idref="DRAWINGS">FIG. 2</figref> in that an advance calculation unit 218 is included as a functional component. As with the other functional components, the advance calculation unit 218 is realized by software or hardware.

0158*** Description of Operation ***

0159Operation of the encryption device 10 and the decryption device 20 according to the second embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 11 and 12</figref>.

0160The operation of the encryption device 10 according to the second embodiment corresponds to an encryption method according to the second embodiment. The operation of the encryption device 10 according to the second embodiment also corresponds to processes of an encryption program according to the second embodiment.

0161The operation of the decryption device 20 according to the second embodiment corresponds to a decryption method according to the second embodiment. The operation of the decryption device 20 according to the second embodiment also corresponds to processes of a decryption program according to the second embodiment.

0162The operation of the encryption device 10 and the decryption device 20 according to the second embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 11 and 12</figref>.

0163The encryption device 10 performs processes indicated in <figref idref="DRAWINGS">FIG. 11</figref> and then executes processes indicated in <figref idref="DRAWINGS">FIG. 3</figref>. Specifically, the encryption device 10 executes the processes indicated in <figref idref="DRAWINGS">FIG. 3</figref>, using a variable S calculated in a process E″ of <figref idref="DRAWINGS">FIG. 11</figref> as data S0 in step S13 of <figref idref="DRAWINGS">FIG. 3</figref>.

0164Similarly, the decryption device 20 executes the processes indicated in <figref idref="DRAWINGS">FIG. 11</figref> and then executes processes indicated in <figref idref="DRAWINGS">FIG. 5</figref>. Specifically, the decryption device 20 executes the processes indicated in <figref idref="DRAWINGS">FIG. 5</figref>, using a variable S calculated in the process E″ of <figref idref="DRAWINGS">FIG. 11</figref> as data S0 in step S23 of <figref idref="DRAWINGS">FIG. 5</figref>.

0165In the following description, the execution of the processes indicated in <figref idref="DRAWINGS">FIG. 11</figref> by the encryption device 10 will be described. For the execution of the processes indicated in <figref idref="DRAWINGS">FIG. 11</figref> by the decryption device 20, the acceptance unit 111, the division unit 112, the advance calculation unit 118, and the communication interface 14 should be read as the acceptance unit 211, the division unit 212, the advance calculation unit 218, and the communication interface 24.

0166(Step S31: Acceptance Process)

0167The acceptance unit 111 accepts input of public data A.

0168Specifically, the acceptance unit 111 receives, via the communication interface 14, the public data A that is input by a user through operation of an input device. The acceptance unit 111 may obtain the public data A from an external server or the like.

0169(Step S32: Division Process)

0170The division unit 112 determines whether or not a length Len(A) of the public data A accepted in step S31 is a multiple of b′ bits. If the length Len(A) is not a multiple of b′ bits, 1 is added to the end of the pubic data A and a bit string of 0 is further added to the end so that the length Len(A) is a multiple of b′ bits, so as to generate data A*. On the other hand, if the length Len(A) is a multiple of b′ bits, the public data A is treated as the data A*.

0171The division unit 112 divides the data A* generated in step S32 into blocks of b′ bits, so as to generate data A[1], . . . , data A[a] each having b′ bits, where “a” is an integer of 1 or greater.

0172(Step S33: Variable Setting Process)

0173The variable setting unit 113 sets fixed data IV of n bits to a variable S internal to the encryption device 10. The fixed data IV is data whose least significant c′ bits are different from those of const[1], const[2], const[3], const[4], and const[5].

0174(Step S34: Advance Calculation Process)

0175The advance calculation unit 118 executes the following processes A″ to B″ for each integer i=1, . . . , a−1 in ascending order. Then, processes C″ to E″ are executed.

0176(Process A″)

0177The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S and data X*[i] that is data A[i] to which a bit string of c′ bits is added. Here, the advance calculation unit 118 uses the data X* [i] that is the data A[i] to the end of which c′ bits of 0 are added.

0178That is, the advance calculation unit 118 calculates S=S XOR (A[i]∥0c′).

0179(Process B″)

0180The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S updated in the process A″ and the key K.

0181That is, the advance calculation unit 118 calculates S=EK(S).

0182(Process C″)

0183The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S and data X*[a] that is the data A[a] to which a bit string of c′ bits is added. Here, the advance calculation unit 118 uses the data X*[a] that is the data A[a] to the end of which c′ bits of 0 are added.

0184That is, the advance calculation unit 118 calculates S=S XOR (A[a]∥0c′).

0185(Process D″)

0186If the length of the public data A is a multiple of b′ bits, the advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in the process B″ and a constant const[4]. Here, the advance calculation unit 118 calculates the exclusive OR using as input the variable S and data that is a bit string of c′ bits representing the constant const[4] to the beginning of which b′ bits of 0 are added. That is, the advance calculation unit 118 calculates S=S XOR (0b′∥str[c′](const[4])).

0187On the other hand, if the length of the public data A is not a multiple of b′ bits, the advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in the process B″ and a constant const[5]. Here, the advance calculation unit 118 calculates the exclusive OR using as input the variable S and data that is a bit string of c′ bits representing the constant const[5] to the beginning of which b′ bits of 0 are added. That is, the advance calculation unit 118 calculates S=S XOR (0b′∥str[c′](const[5])).

0188(Process E″)

0189The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S updated in the process D″. That is, the advance calculation unit 118 calculates S=EK(S).

0190*** Effects of Second Embodiment ***

0191As described above, the encryption device 10 and the decryption device 20 according to the second embodiment allow the construction of an authenticated encryption algorithm from the encryption function E of the block cipher and the exclusive OR (XOR) without using a decryption function of the block cipher, even when the public data A is involved. The size of the variable S, which is an internal variable, is n bits. Therefore, the size of the internal variable can be made smaller than that of the authenticated encryption algorithm JAMBU while the implementation size is equivalent to that of the authenticated encryption algorithm JAMBU.

0192Examples of the fixed data IV, const[1], const[2], const[3], const[4], and const[5] will be described. For example, the fixed data IV is 0n, const[1] is 3, const[2] is 1, const[3] is 2, const[4] is 1, and const[5] is 2. In this case, it is required that the integer c′≥3 and the integer c″≥3.

0193The value of the integer c is determined by taking security into consideration. In the authenticated encryption algorithms described in the first and second embodiments, security can be assured until the number of times the encryption function E of the block cipher is invoked in the encryption function Enc exceeds 2n/2 times, or the number of times the encryption function E of the block cipher is invoked upon failure of verification in the decryption function Dec exceeds 2c. When the number of times the encryption function E of the block cipher is invoked exceeds either of these numbers of times, the key K needs to be changed in order to assure security.

0194For example, when the number of times the encryption function E of the block cipher is invoked upon failure of verification in the decryption function Dec is limited to 216, the minimum value of the integer c is 16.

REFERENCE SIGNS LIST

019510: encryption device, 11: processor, 12: memory, 13: storage, 14: communication interface, 15: electronic circuit, 111: acceptance unit, 112: division unit, 113: variable setting unit, 114: function calculation unit, 115: authenticator generation unit, 116: ciphertext generation unit, 117: output unit, 118: advance calculation unit, 20: decryption device, 21: processor, 22: memory, 23: storage, 24: communication interface, 25: electronic circuit, 211: acceptance unit, 212: division unit, 213: variable setting unit, 214: function calculation unit, 215: authenticator generation unit, 216: message generation unit, 217: output unit, 218: advance calculation unit.

Contents7

Every citation, both ways

Citations
Document	Relation	Office	Cited during
US2025202700A1	Cited by	United States of America	Search report
US12580732B2	Cited by	United States of America	Applicant
US12476809B2	Cited by	United States of America	Search report
US10268832B1	Cites	United States of America	Search report
US10313129B2	Cites	United States of America	Search report
US10341088B2	Cites	United States of America	Search report
US10387350B1	Cites	United States of America	Search report
US10560269B2	Cites	United States of America	Search report
US10783269B1	Cites	United States of America	Search report
US10904231B2	Cites	United States of America	Search report
US11095453B2	Cites	United States of America	Search report
US11153068B2	Cites	United States of America	Search report
US2002071552A1	Cites	United States of America	Search report
US2003108196A1	Cites	United States of America	Search report
US2004019783A1	Cites	United States of America	Search report
US2004039919A1	Cites	United States of America	Search report
US2004177252A1	Cites	United States of America	Search report
US2004250095A1	Cites	United States of America	Search report
US2004252836A1	Cites	United States of America	Search report
US2005108555A1	Cites	United States of America	Search report
US2006026442A1	Cites	United States of America	Applicant
JP2006039206A	Cites	Japan	Applicant
US2006195402A1	Cites	United States of America	Search report
US2006285684A1	Cites	United States of America	Search report
WO2007052477A1	Cites	World Intellectual Property Organization (WIPO)	Applicant
US2007081668A1	Cites	United States of America	Search report
WO2007105709A1	Cites	World Intellectual Property Organization (WIPO)	Applicant
US2008005564A1	Cites	United States of America	Search report
US2008069347A1	Cites	United States of America	Search report
US2008084996A1	Cites	United States of America	Search report
US2008112561A1	Cites	United States of America	Search report
US2008172562A1	Cites	United States of America	Search report
US2008222414A1	Cites	United States of America	Search report
US2008250297A1	Cites	United States of America	Search report
US2008260147A1	Cites	United States of America	Search report
US2009034725A1	Cites	United States of America	Search report
US2009138710A1	Cites	United States of America	Applicant
US2009196416A1	Cites	United States of America	Search report
US2009208018A1	Cites	United States of America	Search report
US2010027783A1	Cites	United States of America	Search report
US2010067698A1	Cites	United States of America	Search report
US2010088517A1	Cites	United States of America	Search report
US2010246809A1	Cites	United States of America	Applicant
US2010268960A1	Cites	United States of America	Search report
US2010303229A1	Cites	United States of America	Search report
US2011026712A1	Cites	United States of America	Search report
US2011051927A1	Cites	United States of America	Search report
US2011138192A1	Cites	United States of America	Search report
US2011150225A1	Cites	United States of America	Search report
US2011238989A1	Cites	United States of America	Search report
US2011255689A1	Cites	United States of America	Search report
US2012008767A1	Cites	United States of America	Search report
US2012076293A1	Cites	United States of America	Search report
US2012096273A1	Cites	United States of America	Search report
US2012096274A1	Cites	United States of America	Search report
US2013145169A1	Cites	United States of America	Search report
US2014101445A1	Cites	United States of America	Search report
US2014146964A1	Cites	United States of America	Search report
US2014211938A1	Cites	United States of America	Search report
US2014317407A1	Cites	United States of America	Search report
US2014365779A1	Cites	United States of America	Search report
WO2015015702A1	Cites	World Intellectual Property Organization (WIPO)	Applicant
US2015149771A1	Cites	United States of America	Search report
US2016006568A1	Cites	United States of America	Search report
JP2016157055A	Cites	Japan	Applicant
US2016173276A1	Cites	United States of America	Applicant
US2017061833A1	Cites	United States of America	Search report
US2017126409A1	Cites	United States of America	Search report
US2017272239A1	Cites	United States of America	Search report
US2017293765A1	Cites	United States of America	Search report
US2017353440A1	Cites	United States of America	Search report
US2017364688A1	Cites	United States of America	Search report
US2017366340A1	Cites	United States of America	Search report
US2018241544A1	Cites	United States of America	Search report
US2018253559A1	Cites	United States of America	Search report
US2019268136A1	Cites	United States of America	Search report
US2020076611A1	Cites	United States of America	Search report
US2020186328A1	Cites	United States of America	Search report
US2021314088A1	Cites	United States of America	Search report
US6396928B1	Cites	United States of America	Search report
US6570989B1	Cites	United States of America	Search report
US7529366B2	Cites	United States of America	Search report
US7827408B1	Cites	United States of America	Search report
US7949129B2	Cites	United States of America	Search report
US8108682B2	Cites	United States of America	Search report
US8121284B2	Cites	United States of America	Search report
US8589688B2	Cites	United States of America	Search report
US9166793B2	Cites	United States of America	Search report
US9438416B2	Cites	United States of America	Search report
US9496897B1	Cites	United States of America	Search report
US9497021B2	Cites	United States of America	Search report
US9537657B1	Cites	United States of America	Search report
US9680653B1	Cites	United States of America	Search report
US9773432B2	Cites	United States of America	Search report
US9787475B2	Cites	United States of America	Search report
US9800403B1	Cites	United States of America	Search report
US9880960B1	Cites	United States of America	Search report
US9917695B2	Cites	United States of America	Search report
US20020071552A1	Cites	United States of America	Search report
US20030108196A1	Cites	United States of America	Search report

Showing 100 of 197

10 members in 5 offices

This recordMember, by publication date

Members10

Family members, oldest first
Document	Office	Kind
WO2019043921A1	World Intellectual Property Organization (WIPO)	A1	2019-03-07
JPWO2019043921A1	Japan	A1	2020-04-16
CN111052670A	China	A	2020-04-21
EP3661115A1	European Patent Office (EPO)	A1	2020-06-03
EP3661115A4	European Patent Office (EPO)	A4	2020-06-03
US2020186328A1	United States of America	A1	2020-06-11
JP6735926B2	Japan	B2	2020-08-05
US11438137B2This record	United States of America	B2	2022-09-06
EP3661115B1	European Patent Office (EPO)	B1	2024-01-17
CN111052670B	China	B	2024-02-09

64 transactions on the USPTO file

Allowed after 1 non-final rejection.

Non-final rejections: 1
Final rejections: 0
RCEs: 0
Appeals: 0

Over time

Point at a mark for the transaction

Transactions

Prosecution transactions, newest first
	Event	Code
2026-04-27	Maintenance Fee Reminder MailedREM.	REM.
2022-09-06	Recordation of Patent Grant MailedPGM/	PGM/
2022-09-06	Patent Issue Date Used in PTA CalculationAllowedPTAC	PTAC
2022-08-18	Email NotificationEML_NTR	EML_NTR
2022-08-17	Issue Notification MailedAllowedWPIR	WPIR
2022-07-29	Dispatch to FDCD1935	D1935
2022-07-29	Application Is Considered Ready for IssuePILS	PILS
2022-07-27	Issue Fee Payment VerifiedN084	N084
2022-07-27	Issue Fee Payment ReceivedIFEE	IFEE
2022-06-30	Email NotificationEML_NTR	EML_NTR
2022-06-30	Mailing Corrected Notice of AllowabilityMCNOA	MCNOA
2022-06-16	Corrected Notice of AllowabilityCNOA	CNOA
2022-06-13	Pubs Case Remand to TCPUBTC	PUBTC
2022-06-09	Electronic ReviewELC_RVW	ELC_RVW
2022-06-09	Email NotificationEML_NTF	EML_NTF
2022-06-09	Mail Notice of AllowanceAllowedMN/=.	MN/=.
2022-06-06	Notice of Allowance Data Verification CompletedAllowedN/=.	N/=.
2022-06-02	Information Disclosure Statement consideredIDSC	IDSC
2022-06-02	Information Disclosure Statement consideredIDSC	IDSC
2022-05-26	PTA statement filed under PTA1.704(d) with IDSIDSPTA	IDSPTA
2022-05-26	Electronic Information Disclosure StatementEIDS.	EIDS.
2022-05-26	Information Disclosure Statement (IDS) FiledWIDS	WIDS
2022-05-16	Information Disclosure Statement (IDS) FiledM844	M844
2022-05-16	Information Disclosure Statement (IDS) FiledWIDS	WIDS
2022-04-24	Date Forwarded to ExaminerFWDX	FWDX
2022-04-18	Response after Non-Final ActionA...	A...
2022-02-14	Electronic ReviewELC_RVW	ELC_RVW
2022-02-14	Email NotificationEML_NTF	EML_NTF
2022-02-14	Mail Non-Final RejectionNon-final rejectionMCTNF	MCTNF
2022-02-09	Non-Final RejectionNon-final rejectionCTNF	CTNF
2022-02-07	Information Disclosure Statement consideredIDSC	IDSC
2022-02-07	Information Disclosure Statement consideredIDSC	IDSC
2022-02-07	Information Disclosure Statement consideredIDSC	IDSC
2022-02-07	Information Disclosure Statement consideredIDSC	IDSC
2021-11-01	Information Disclosure Statement (IDS) FiledM844	M844
2021-11-01	Information Disclosure Statement (IDS) FiledWIDS	WIDS
2021-08-15	Case Docketed to Examiner in GAUDOCK	DOCK
2020-12-04	Information Disclosure Statement (IDS) FiledM844	M844
2020-12-04	Information Disclosure Statement (IDS) FiledWIDS	WIDS
2020-12-03	Case Docketed to Examiner in GAUDOCK	DOCK
2020-09-28	Case Docketed to Examiner in GAUDOCK	DOCK
2020-06-12	Email NotificationEML_NTR	EML_NTR
2020-06-11	Application ready for PDX access by participating foreign officesCCRDY	CCRDY
2020-06-11	PG-Pub Issue NotificationPG-ISSUE	PG-ISSUE
2020-06-03	Information Disclosure Statement (IDS) FiledM844	M844
2020-06-03	Information Disclosure Statement (IDS) FiledWIDS	WIDS
2020-03-13	Case Docketed to Examiner in GAUDOCK	DOCK
2020-03-12	Application Is Now CompleteCOMP	COMP
2020-03-12	Application Dispatched from OIPEOIPE	OIPE
2020-03-04	Email NotificationEML_NTR	EML_NTR
2020-03-04	Email NotificationEML_NTR	EML_NTR
2020-03-04	Notice of DO/EO Acceptance MailedM903	M903
2020-03-04	Filing ReceiptFLRCPT.O	FLRCPT.O
2020-03-03	Sent to Classification ContractorPGPC	PGPC
2020-03-03	FITF set to YES - revise initial settingFTFS	FTFS
2020-03-01	371 Completion Date371COMP	371COMP
2020-01-13	Information Disclosure Statement (IDS) FiledM844	M844
2020-01-13	Patent Term Adjustment - Ready for ExaminationPTA.RFE	PTA.RFE
2020-01-13	PTO/SB/69-Authorize EPO Access to Search ResultsSREXR141	SREXR141
2020-01-13	Applicants have given acceptable permission for participating foreignAPPERMS	APPERMS
2020-01-13	Cleared by OIPE CSRL194	L194
2020-01-13	Information Disclosure Statement (IDS) FiledWIDS	WIDS
2020-01-13	Entity Status Set To Undiscounted (Initial Default Setting or Status Change)BIG.	BIG.
2020-01-13	Initial Exam Team nnIEXX	IEXX

11 legal events, as the office reported them to INPADOC

Over the term

Point at a mark for the event

Events

Legal events, newest first
	Event	Code
2026-04-27	Fee payment procedureMAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITYFEPP	FEPP
2022-08-17	Information on status: patent grantGrantedPATENTED CASESTCF	STCF
2022-07-28	Information on status: patent application and granting procedure in generalPUBLICATIONS -- ISSUE FEE PAYMENT VERIFIEDSTPP	STPP
2022-06-16	Information on status: patent application and granting procedure in generalNOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONSSTPP	STPP
2022-06-13	Information on status: patent application and granting procedure in generalAWAITING TC RESP., ISSUE FEE NOT PAIDSTPP	STPP
2022-06-07	Information on status: patent application and granting procedure in generalNOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONSSTPP	STPP
2022-04-24	Information on status: patent application and granting procedure in generalRESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINERSTPP	STPP
2022-02-10	Information on status: patent application and granting procedure in generalNON FINAL ACTION MAILEDSTPP	STPP
2020-03-13	Information on status: patent application and granting procedure in generalDOCKETED NEW CASE - READY FOR EXAMINATIONSTPP	STPP
2020-01-14	AssignmentAS	AS
2020-01-13	Fee payment procedureENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITYFEPP	FEPP